Encryption-Algorithms Keys

In weighing whether a data breach notification should be sent, an entity must first determine specifically what data was breached by an unauthorized party. But when you throw in the use of encryption technology, it can complicate the decision-making.

The forensic challenges posed by encryption platforms were on full display last month when Amazon.com Inc. released the forensic report of CEO Jeff Bezos' alleged cellphone hacking incident.

FTI Consulting, which conducted the forensic investigation, alleged Bezos' cellphone was hacked through a message delivered through WhatsApp. However, FTI acknowledged the app's encryption features made it "virtually impossible to decrypt" or determine if the message contained any malicious code.

To be sure, this situation isn't unique. The lack of definitive proof data was breached by an unauthorized party is a reality for many companies whose employees leverage ephemeral or encrypted messages.

The potential for an internal investigation, discovery or intellectual property risk is "much more difficult to remediate if you can't get access to the immediate data," said Robert Cruz, senior director of information governance at Smarsh, an archiving and compliance tech provider for financial service entities.

Despite the uncertainty, after a suspected attack, there is a responsibility to determine if the cyber incident falls under the scope of 50 different states' data breach notification laws.

"The company and counsel may take any of a number of steps to investigate the potential breach, including retaining expert forensic consultants to conduct a thorough investigation," said Alston & Bird privacy and data security teams partner Lawrence Sommerfeld.

To be sure, some states impose a deadline for companies to notify residents or regulators of a data breach, even as a company struggles to understand what data was impacted.

Ultimately, companies are motivated to notify regulators based on where potentially impacted data subjects live and what jurisdiction applies, said Boston-based Prince Lobel Tye partner William Rogers Jr.

"If they know enough in Massachusetts to determine there was a breach of their security and that includes three types of security, technological, physical security or administrative security … [then] theoretically, [they] should be reporting it," Rogers explained.

However, some states may require notification where there's been an exfiltration of data or a reason to believe there were unauthorized access to data, Rogers noted. 

For Cruz's part, he's seen clients err on the side of caution and provide notification if they believe personal data was breached.

"I think firms would rather go on the conservative end and not have something exposed later on," he said. He noted that WhatsApp allegedly being leveraged as a backdoor to access personal data is the latest example that companies need to have policies and solutions to mitigate risk.

"It highlights another potential entry point for malware [for] a breach that could violate your regulatory obligations. It's a tremendous area of exposure if firms don't have the controls or they aren't looking at technologies [where they have more visibility]," he said.